Verifying functional correctness of message-passing programs in Coq - PowerPoint PPT Presentation

Verifying functional correctness of message-passing programs in Coq Robbert Krebbers, TU Delft Joint work with Jonas Kastberg Hinrichsen, ITU Jesper Bengtson, ITU 4 June 2020 @ VEST Workshop, Online 1

Type checking message-passing programs using session types Example program: let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in send c ′ ( x + 2) } ; send c 40; recv c Session types: c ′ : ? N . ! N . end c : ! N . ? N . end and Properties obtained: ✓ Type safety / session fidelity � � ✗ Functional correctness 2

How to prove functional correctness of message-passing programs Combine ◮ Session Types [ Honda et al., ESOP’98 ] ◮ Type system for channels ◮ Example: ! N . ? N . end ◮ Ensures safety automatically through static type checking ◮ Concurrent Separation Logic [ O’Hearn & Brooks, CONCUR’04 ] ◮ Logic for reasoning about concurrent programs with mutable state. ◮ Example: { x �→ a ∗ y �→ b } swap x y { x �→ b ∗ y �→ a } ◮ Establish functional correctness through interactive or semi-automated proofs 3

Actris [Kastberg Hinrichsen, Bengtson, Krebbers; POPL’20] A concurrent separation logic for proving functional correctness of programs that combine message passing with other programming and concurrency paradigms ◮ New notion of dependent separation protocols for reasoning about message passing in separation logic ◮ Integration with Iris and its existing concurrency mechanisms ◮ Verification of feature-complete programs including a variant of map-reduce ◮ A full mechanization of all of the above in Coq with tactics for interactive program proofs 4

Dependent separation protocols Dependent separation protocols: Session types: Example: Example: ! ( x : N) � x � { 10 < x } . ? � x + 2 � { True } . end ! N . ? N . end 5

Dependent separation protocols Dependent separation protocols: Session types: Example: Example: ! ( x : N) � x � { 10 < x } . ? � x + 2 � { True } . end ! N . ? N . end Protocols: Protocols: prot � ! � st � ! T . st x : � τ � v � { P } . prot | ? � x : � τ � v � { P } . prot | ? T . st | end | end 5

Dependent separation protocols Dependent separation protocols: Session types: Example: Example: ! ( x : N) � x � { 10 < x } . ? � x + 2 � { True } . end ! N . ? N . end Protocols: Protocols: prot � ! � st � ! T . st x : � τ � v � { P } . prot | ? � x : � τ � v � { P } . prot | ? T . st | end | end Duality: Duality: ! � x : � τ � v � { P } . prot = ? � x : � τ � v � { P } . prot ! T . st = ? T . st ? � x : � τ � v � { P } . prot = ! � x : � τ � v � { P } . prot ? T . st = ! T . st end = end end = end 5

Proof rules for dependent separation protocols Dependent separation protocols: Session types: { True } new chan () newchan () : st ⊗ st { ( c , c ′ ) . c ֌ prot ∗ c ′ ֌ prot } { c ֌ ! � τ � v � { P } . prot ∗ P [ � x ] } x : � t /� send c ( v [ � send : ( ! T . st ⊗ T ) ⊸ st t /� x ]) { c ֌ prot [ � x ] } t /� { c ֌ ? � x : � τ � v � { P } . prot } recv : ? T . st ⊸ ( T ⊗ st ) recv c { w . ∃ � t . ( w = v [ � x ]) ∗ c ֌ prot [ � x ] ∗ P [ � x ] } t /� t /� t /� 6

Example – Dependency between messages Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in send c ′ ( x + 2) } ; send c 40; recv c { w . w = 42 } 7

Example – Dependency between messages Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in send c ′ ( x + 2) } ; send c 40; recv c { w . w = 42 } Dependent separation protocols: c ֌ ! ( x : N) � x � { True } . ? � x + 2 � { True } . end c ′ ֌ ? ( x : N) � x � { True } . ! � x + 2 � { True } . end 7

Example – Dependency between messages Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in send c ′ ( x + 2) } ; send c 40; recv c { w . w = 42 } Dependent separation protocols: c ֌ ! ( x : N) � x � { True } . ? � x + 2 � { True } . end c ′ ֌ ? ( x : N) � x � { True } . ! � x + 2 � { True } . end Properties obtained: ✓ Type safety / session fidelity � ✓ Functional correctness � 7

Example – References Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in x ← (! x + 2); send c ′ () } ; let y = ref (40) in send c y ; recv c ; ! y { w . w = 42 } 8

Example – References Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in x ← (! x + 2); send c ′ () } ; let y = ref (40) in send c y ; recv c ; ! y { w . w = 42 } Dependent separation protocols: c ֌ ! ( ℓ : Loc)( x : N) � ℓ � { ℓ �→ n } . ? � () � { ℓ �→ ( x + 2) } . end c ′ ֌ ? ( ℓ : Loc)( x : N) � ℓ � { ℓ �→ n } . ! � () � { ℓ �→ ( x + 2) } . end 8

Example – References Example program: { True } let ( c , c ′ ) = new chan () in fork { let x = recv c ′ in x ← (! x + 2); send c ′ () } ; let y = ref (40) in send c y ; recv c ; ! y { w . w = 42 } Dependent separation protocols: c ֌ ! ( ℓ : Loc)( x : N) � ℓ � { ℓ �→ n } . ? � () � { ℓ �→ ( x + 2) } . end c ′ ֌ ? ( ℓ : Loc)( x : N) � ℓ � { ℓ �→ n } . ! � () � { ℓ �→ ( x + 2) } . end Properties obtained: ✓ Type safety / session fidelity � ✓ Functional correctness � 8

Soundness of Actris If { True } e { v . φ ( v ) } is provable in Actris then: ✓ Type safety/session fidelity: e will not crash and not send wrong messages � ✓ Functional correctness: If e terminates with v , the postcondition φ ( v ) holds � 9

Soundness of Actris If { True } e { v . φ ( v ) } is provable in Actris then: ✓ Type safety/session fidelity: e will not crash and not send wrong messages � ✓ Functional correctness: If e terminates with v , the postcondition φ ( v ) holds � Obtained by modeling Actris as an embedded domain-specific logic in Iris 9

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq 10

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq ◮ Powerful: supports reasoning about intricate concurrent programs 10

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq ◮ Powerful: supports reasoning about intricate concurrent programs ◮ General: unifies the reasoning principles in many other logics 10

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq ◮ Powerful: supports reasoning about intricate concurrent programs ◮ General: unifies the reasoning principles in many other logics ◮ Language-independent: parameterized by the language 10

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq ◮ Powerful: supports reasoning about intricate concurrent programs ◮ General: unifies the reasoning principles in many other logics ◮ Language-independent: parameterized by the language ◮ Modeling logics: can be used to model domain-specific logics 10

Iris [Jung, Krebbers et al.; POPL’15, ICFP’16, ESOP’17, JFP’18] A powerful, general, language-independent, framework for modeling your own domain specific higher-order separation logics with powerful tactics in Coq ◮ Powerful: supports reasoning about intricate concurrent programs ◮ General: unifies the reasoning principles in many other logics ◮ Language-independent: parameterized by the language ◮ Modeling logics: can be used to model domain-specific logics ◮ Tactics in Coq: for interactive correctness proofs of programs 10

Implementation and model of Actris in Iris Approach: ◮ Implement new chan , send , and recv as a library using lock-protected buffers ◮ Define c ֌ prot using Iris’s invariant and ghost state machinery ◮ Prove Actris’s proof rules as lemmas in Iris 11

Implementation and model of Actris in Iris Approach: ◮ Implement new chan , send , and recv as a library using lock-protected buffers ◮ Define c ֌ prot using Iris’s invariant and ghost state machinery ◮ Prove Actris’s proof rules as lemmas in Iris Benefits: ✓ Can readily reuse all powerful reasoning mechanisms of Iris � ✓ Can readily reuse Iris’s support for interactive proofs in Coq � ✓ Actris’s soundness result is a corollary of Iris’s soundness � ✓ Very small Coq mechanization � (200 lines for channel implementation and proofs, 1000 lines for the definition and proof rules of c ֌ prot , 450 lines for Coq tactics specific for message passing) 11

Demo in Coq 12